There's a SQL Server doc on how to Configure antivirus software to work with SQL Server which I recommend you take a look, as it might help in your case without risking having compliance problems (they're off-topic as already mentioned in comment).
Here's an excerpt from the Directories and file name extensions to exclude from virus scanning section of the doc:
When you configure your antivirus software settings, make sure that
you exclude the following files or directories (as applicable) from
virus scanning. Exclusion may improve SQL Server performance and
ensures that the files aren't locked when the SQL Server service must
use them. However, if these files become infected, your antivirus
software can't detect the infection. For more information about the
default file locations for SQL Server, see File Locations for Default
and Named Instances of SQL Server.
In the files listed you can find:
- SQL Server data files
- SQL Server backup files
- Full-Text catalog files
- Trace files
- Extended Event file targets
- SQL audit files
- SQL query files
- Filestream data files
- Remote Blob Storage files
- Exception dump files
- In-memory OLTP files
- DBCC CHECKDB files
It's possible the high processing consumption of the antivirus you mentioned comes from scanning big database files, so removing them from scan might reduce that overload, hence not requiring adding more CPU to the VM.